critical9.8
CVE-2026-41304
WWBN AVideo is an open source video platform.
Impact
WWBN AVideo is an open source video platform. In versions 29.0 and below, the `cloneServer.json.php` endpoint in the CloneSite plugin constructs shell commands using user-controlled input (`url` parameter) without proper sanitization. The input is directly concatenated into a `wget` command executed via `exec()`, allowing command injection. An attacker can inject arbitrary shell commands by breaking out of the intended URL context using shell metacharacters (e.g., `;`). This leads to Remote Code Execution (RCE) on the server. Commit 473c609fc2defdea8b937b00e86ce88eba1f15bb contains a fix.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | wwbn/avideo | <= 29.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wwbn | Avideo | through 29.0 |